36a6dfd355b7c3c1119ea2c44d22dec86aee3178b35d80e86dfd07c8261c73ce

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
Size 8.9MB
Sample260930-ct2vravwby
SHA256 36a6dfd355b7c3c1119ea2c44d22dec86aee3178b35d80e86dfd07c8261c73ce
MD5 42db9825d91c7b87f94234b87f4a5ba5
SHA1 c96d447bab4cd3c27aae9b1eec45776a5bc551ea
SHA512 abf931eb411560ef75ee63a04a2c0702bd87ae9fad35c1303a24ec5d804ba1bbd93d12b3e6ba0c17ae4fd477719cc1c00aebd73a8f2e5ab37a24a159fa5830f1
SSDEEP 98304:qOjygqTeYtrA2CQ+J1bMfwKNNUtiOWh5eI54rItr8ihz5tiw1j2+OFae348KYpf0:bxVX1bMf4ir/eI5PDBtHOQe3LIOYQp
TLSH
T1DD969E07F29580EDC09EC2B8C70AE637E632B8894634B69F27945F126F76B905F1E714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery macro spyware stealer upx

Malware Config

Signatures

Suspicious Office macro 1 IoCs

Office document equipped with macros.

macro

resource
behavioral2/files/0x000d00000001c506-359.dat

Executes dropped EXE 8 IoCs

pid	Process
240	elevation_service.exe
4208	elevation_service.exe
1868	maintenanceservice.exe
1996	OSE.EXE
4808	SensorDataService.exe
4400	ssh-agent.exe
4968	AgentService.exe
4144	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\F:\	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe

Drops file in System32 directory 43 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6563303a7465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3108-8-0x0000000140000000-0x000000014197E000-memory.dmp	upx
behavioral2/memory/3108-106-0x0000000140000000-0x000000014197E000-memory.dmp	upx
behavioral2/files/0x0001000000009337-371.dat	upx
behavioral2/files/0x00010000000093af-372.dat	upx
behavioral2/files/0x0001000000009952-373.dat	upx
behavioral2/files/0x000100000001b952-374.dat	upx
behavioral2/files/0x0001000000009cd6-375.dat	upx
behavioral2/files/0x0001000000009cfe-376.dat	upx
behavioral2/files/0x0001000000009b92-380.dat	upx
behavioral2/files/0x0001000000009371-386.dat	upx
behavioral2/files/0x000100000000627a-392.dat	upx
behavioral2/files/0x000100000000bd4d-391.dat	upx
behavioral2/files/0x0001000000006223-390.dat	upx
behavioral2/files/0x000100000000a319-389.dat	upx
behavioral2/files/0x000100000000a304-388.dat	upx
behavioral2/files/0x000100000000a2c1-387.dat	upx
behavioral2/files/0x000100000000a1d4-385.dat	upx
behavioral2/files/0x000100000000a0ce-384.dat	upx
behavioral2/files/0x000100000000ba3d-383.dat	upx
behavioral2/files/0x0001000000006215-381.dat	upx
behavioral2/files/0x0001000000009fd4-379.dat	upx
behavioral2/files/0x000100000000df21-378.dat	upx
behavioral2/files/0x000100000000b974-377.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\javaws.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002b50bfac8250dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004675dbac8250dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c460fcac8250dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000003e748fb18250dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e8739ef8250dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb0b48ad8250dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
240	elevation_service.exe
240	elevation_service.exe
240	elevation_service.exe
240	elevation_service.exe
240	elevation_service.exe
240	elevation_service.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	4968	AgentService.exe
Token: 33	4144	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4144	SearchIndexer.exe
Token: SeDebugPrivilege	3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
Token: SeDebugPrivilege	3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
Token: SeDebugPrivilege	3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
Token: SeDebugPrivilege	3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
Token: SeDebugPrivilege	3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
Token: SeDebugPrivilege	3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
Token: SeDebugPrivilege	3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
Token: SeDebugPrivilege	3108	2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
Token: SeDebugPrivilege	240	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 3184	4144	SearchIndexer.exe	97
PID 4144 wrote to memory of 5304	4144	SearchIndexer.exe	98
PID 4144 wrote to memory of 3904	4144	SearchIndexer.exe	99
PID 4144 wrote to memory of 4976	4144	SearchIndexer.exe	100
PID 4144 wrote to memory of 5796	4144	SearchIndexer.exe	102
PID 4144 wrote to memory of 4752	4144	SearchIndexer.exe	103
PID 4144 wrote to memory of 5412	4144	SearchIndexer.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_42db9825d91c7b87f94234b87f4a5ba5_cobalt-strike_glassworm_icedid_mespinoza_njrat_poet-rat_ryuk_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3108

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4208

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1868

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1996

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4808

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4400

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4968

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3184
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5304
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3904
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4976
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5796
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4752
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bdf5a062029de6414fb3b49d3dc450f84539f356f4fb62728bedafc6c59acc5c
MD5 76146f47b8cf146aa6cbbddbb12c76c6
SHA1 fddc5623ddf917c57a9a5fe9948b8cd80e3f3159
SHA512 7c19dfed73aa348bd8dd60a79e576dc5e85db04434f5822cf54a6d69880216b4096017d65b1ec6d55cf76544bcbdd5eb7056a1fbad450dd59660e8159c4d0d15
SSDEEP 49152:tb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnUQKKYpWwl1+NY:z3q6sjBTKYpfg
TLSH
T195D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.2MB
SHA256 729657e9c6ed6ffc3fcae323290b14745e4656dbf883ad05f33539482e431e9c
MD5 09bead1f0ad18e547f782da6adbb73e2
SHA1 0bc49a486eaa29c6320f0fd274cda568b617b309
SHA512 d5bf3df197895512e3116efcf56ba7830856f10281b09687995e9b2bfafb2150712aee73edf46c7961af4784cfd4dddc304918fcf0ce65558ab0484bb4018d0f
SSDEEP 49152:ctcaQKKYpWwl1+NYBZqDdqq5WjD7ZyvmTp:cbKYpfgP5WLc+Tp
TLSH
T1FAB51229639504F9DE17527CC8F18806E732B85143ACD78B03E0A9661F27FE86E3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 2adfa54f75a5548747435bbf796542003e591d3be17ab23acb021b505b313921
MD5 f2cf2c0acccacb382fa0d4737856d2ee
SHA1 1b99404d010608225a31c4b8ed4b1cf5df385b7e
SHA512 b94baf90a15a3c47ac869f7a40d308530cef7529219f1ec76ceee2f9622e6362b4fdab2eb85841d20f8ae988cc8a9448a5e0a386ba29de2de79f41bde87d8fc5
SSDEEP 12288:91XLsswWkxy2lRq2czAPJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rd6:zXYfDtczAPvoKFLgYHJWwl24C15rDY
TLSH
T1C965F12973E508F8ED67817DCDA28402D633BC5547A0E79B03A0A96A1F337D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 0119d15e75eab9a1e4d3bf38afc236ee7fa9283a5603eba5a657b301e381f47b
MD5 34a4c6002da32b11e84567cbd576f5fa
SHA1 4c3a9947f9f10b5a9f981904c9f97cdeba53e6ea
SHA512 8de3a4e82fd733efc44e01b122cf1ffce9b5f8b2d0b72c661567c88fbb5a45e3011503d3696eb55e6d46819ea953cd4678eebddddd93f92b9936b087e7c885b9
SSDEEP 12288:Lmw5HEjsChNVBFgl0WDm+CqJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb+:Kwu4OW9voKFLgYHJWwl24C15rDY
TLSH
T15065F14A72E90CF9EA678639C597C036E7B2BC012A65C71F5760C65B2F333616E2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c26e7371267bf5faf0b994d08533a3902db84a0e213e60dc30c7d4eb50fda44c
MD5 ac05f2333f993f96154df315c786fbb1
SHA1 fcfb3d85194699ebdbeec5f95e786fcfe1af5296
SHA512 69845688a89ff585b69ccc5165785d0b0ba84b00c2f7aef05c2166c3fc489802874c219341c228c0519d512c4fcad88a2ead26c7b772356f3734c64b8c59f2bc
SSDEEP 49152:kB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glfQKKYpWwl1+NY:+u6Jmdxd2dfKYpfg
TLSH
T184D59E13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.4MB
SHA256 6785218aadf0d9f856d9868a8b08272b73baf4bfe3379ea2b4b4ec36670059b5
MD5 893c02c77dc4e6edbd06ddeb00549fec
SHA1 cb1b387d9340f2e6540a3d3f38516fb5ce31c23e
SHA512 2fdf98092a83c9af6436e6ba70495a23c891e4a2aacb12cc321b3c7b52455b83649e2c0b3f2f3b7ad295eb145721dabc9af3791b8bc7988bbd110696e4a15e16
SSDEEP 49152:aMnYIQQKKYpWwl1+NYgKdVbsTK/JxZ20jckwq:ZqKYpfgzYYsxZxjcr
TLSH
T11FC5012AEADC04E6E177927C89A7464AF2B17C581B31C6CF125A537E1E33ED05E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 4.3MB
SHA256 7c61340b4b90dba663f198350804cb5084b34f2c97df649bbf49070f9f6bb75d
MD5 4fc7b544b39cb3490fade086bb872d5f
SHA1 5b5632e2398a31ac6965694efc3ad6d8857cd356
SHA512 cd619fa58fb36789a32411582329961eea01600d52ab817296c0b2e103c1ae803fe06e73107bbebce64060f79451eb7f1b7ad0650f5b5bd40ee807b14c7b43eb
SSDEEP 49152:sYVdNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0vQKKYpWwl1+Np:BySzPHKYpfgOYYsxZxjcr
TLSH
T17F269D57A1A801D5C5B9C1B98F0BCC1BFA7134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 1d28634d1bb818f836ec1669714561fce1fcd8e540efc63678d4d21095cccf42
MD5 28b1ff243a3d1bd66bfbe64962dc60a6
SHA1 a4ab2eccab47c9325d7d283aa8301bab38be0e53
SHA512 1c09acb8820ea4349fbd315ec3fe8529fa9c83999b79bab837e85a0eb366dc196374a179341ced63806cf7f9e06e3080308722db581019c9ab262d391a9f6907
SSDEEP 49152:LG7JUQjdirIhCnDHUPfF/fQKKYpWwl1+NYRKdVbsTK/JxZ20jckwq:mJnglD0PBKYpfgOYYsxZxjcr
TLSH
T1CFB5E01EA3EC01E6E5BA927885054A5AEA71782D1F31CACF2270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 988KB
SHA256 93ee224999b389a2cd16d891ca1e4b64f84143928e8d13be933936a7f9abc8ae
MD5 8cfebbbab29cf90c3cdb5e45fbac5d42
SHA1 acbbd2ca91aebe98c4832d7ed56df192e03841ee
SHA512 3063254ee6eb05d5261cf0fc267dbfc1cd4f9838aebf53bebbdfb588f11caf77000d11beba9ecc44e517f4a2d15fc2bc1bb475081c98c40238ff253c8c595d7b
SSDEEP 6144:4MsBC2naiW/xeNC3//FuQ1otMxG7WWU3fvk+fPurnc/YDiqgaTOaK4eV6auQ8Na:4lGeIXWU3fCMqaqtQ8NaXaR7yIX
TLSH
T1002517107666CB5FC6A944321E33C6CCAB707D01EE04AB0772C9873FD576659BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 c08c68f3b5e3928865651630df7de55556edfc79f4d4ad177a0366c7adcc94b8
MD5 1d44859dc94a4228ffcc1270b2e91256
SHA1 d26ec73d4b8cc4a47a188f5af00ff6ac50da8bb8
SHA512 e2f420971e342375679a84e7d148965576684fe2b2d23ac0e898ea61f9102e8e5b43617edbd653cf549dbee11ae30d79bd7000144c2b02a30508618f38cbb40c
SSDEEP 6144:z7e3WkySyCC1Fr6a5e349xe7OFpQytMx3z16SwVTVBqN9hQytMxqDtkOwCYsUjkB:z7e3/yUV49bFW16sUjkfJ/X
TLSH
T19065D6805136A78FD1F76032072A5F8D67A4EC07B7096F27B3C9457AD82AB01A0B93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RemoveInstall.docm

Path C:\Users\Admin\Documents\RemoveInstall.docm
Size 776KB
SHA256 1ad02fdf9014a34bb828bfea15f28d6ba8ecd32c15e0dcf1812505eeffb2016b
MD5 f6b61f2b544bbd94205711497038bf29
SHA1 ba115ec2eb1a4387c2203cd0d85e06c5d0331089
SHA512 925d0ad203cf4e926690beff7043e344278d4e69cf9cf02307af767ee7b94bad853181ce9730aef0de9b457f89da819686eb4c3b913dd22f49112997e8bd175c
SSDEEP 12288:8bI3mR4uRkDjePHInM30ieL+SO3Zz/EoLIvNxWLlJNKBuYa0JHRtV/o:8bZth/InMhgO3Zz/EPvXWLXNKBa0zo
TLSH
T16DF433E35D1A7545FCA808FA522202C3B52D8DFBB942C70FD2E5D629F546DB8322139E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWow64\perfhost.exe
Size 782KB
SHA256 4ea29babdb67909abc712001bd329b85e556ea13924c46dceedaa46bb7197aae
MD5 3e379f2a34450c6ebb0ba6e5db303489
SHA1 d5e7414c070fea62452f70d25685a362c5f6897d
SHA512 70cd3c4ed8e2ea26767384405512f4adabc5a5d7ca7cb46749ad3e4ad739ad0a18bc8c57f88b602c92138a748a90be727a6f7c91c294f20cbb91c1ecf06ad0d1
SSDEEP 24576:RsKdIBAj1bsTEleyTJ6UAe+a20jckwqbJ:RsKdVbsTK/JxZ20jckwq
TLSH
T15C052327A89C2E37DC4B3BF1440D05E7246D7EBCAB01985AB56A477DBC54FC02F2294A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 986d8778b24114d7468802721149605cad6e8f0030a0edb00bd0089805510d59
MD5 936e1c523c1137f18e44e7e077b56b6b
SHA1 2b18983b18aa1a7eacc47116f8fe1e30f58e2819
SHA512 0d62372584b2e736519b163cfc7883a89e612a1c75f4db7d4f317eda45839ac1d15310492a55b09a04b1ec3e50b8a288c6b88ec0bfac9ae63d8acbd5a96db08b
SSDEEP 24576:Ngb6bmBIi49WNNFpg1rSvFv7bYKvoKFLgYHJWwl24C15rDY:Ngb4mBIBhGFFQKKYpWwl1+NY
TLSH
T1FF65AE1E22EC02F5E1FAD2B89DAA4417D6B278160731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 836KB
SHA256 9665f57e08c756d6d4ac49969808b5ae197524d1679d5298aa8c9df5050bed41
MD5 6502cf3fc641ad0f8abc87a0cbebb92a
SHA1 923579b04192dc3b4278ae2a9af36a85ddfd81cb
SHA512 664add715f0e5624acc05f46c4ef76a67a19ed6fe3e0f4bb4358dd170fbe9fe73dd2c05891c8cf51370b4ada1049b6271d7123e233d37517b7fca64f53f7fb2a
SSDEEP 24576:2G7KdIBAj1bsTEleyTJ6UAe+a20jckwqbJ:2G7KdVbsTK/JxZ20jckwq
TLSH
T18905233E64A83937CC6B67B1441905E334B43EB8A71168FF59E9863DAE44BD03B36C49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 1031bb9d1a17dc2434d98757d6b1e3b3f26cccf206552bcdb770b301812767fa
MD5 eb95cc227212990c6eb8c4312fe8b256
SHA1 867783cca02ce7b059bae03faa9570b3095fff40
SHA512 ab60bd82288dc1c869d9d3344c56141564bfb369a77dd88cde6f04c85411231d7caf488f9efc40d785707face348e415293effd5e456fd2253315201f807772f
SSDEEP 24576:FG88u8FpJqH1bzria7/mVvoKFLgYHJWwl24C15rDY:o7ZFPqVea7/iQKKYpWwl1+NY
TLSH
T13E85016576E501F0D47BD13889864663F6B2B8250364EFDF07A88B561F23BE50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.8MB
SHA256 ec53750c557fc34095e3e4a213e812606167eef4db6703abaae81ce7ec0fcd96
MD5 c0cc069391af1322a7c8ab40b149753e
SHA1 a0a176fa02d319bee7ff7eb1a051c036f1a602a1
SHA512 72f10a6dbae6808788d4383e68f5cb2271a685426d36fdf30d0c91d000666627f5a72f3e0900a3b2d920fd97854eec364f0dcc37f92403842b0f4803bdfc15ad
SSDEEP 49152:6BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjAKdVbsTK/JxZ20jcu:lG05lO43bdYYsxZxjcr
TLSH
T1F1D5C06E62EC11F9D0BBD17CD986460BEBB23815033556CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ca1ca40f9ac16c3315630aea1793b74f298ee05df9705a4a56c2fd9bc36d33d6
MD5 42e3131fd4a2c8979e4aa076a831c449
SHA1 498f8f2781d52661595bd59aecf3c910b1862e2f
SHA512 79b1214a6f148806243e7a6592e5794c5e39e1059bfb3a1d6d0aabf2ac2da74b4a1ccfcb92243b42d0a20d1506b78d60672fb769e1f6d9ede3312938adfc8cda
SSDEEP 24576:Mfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnvvoKFLgYHJWwl24C15rDY:Ua5POZ3BJt2pasx2+mxQKKYpWwl1+NY
TLSH
T19465BF5EA2FC01D5D579D17DC583861AE5B1382653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 579aa82b0a78415cf67d055c6892cfa140216760c764c92aed7ab0962a024198
MD5 f03c68476b35df873e2d459971b10d5b
SHA1 90eca958901971c87fbc4b74f69004bcb1506312
SHA512 9741bca3b8c1b8d6af36fe9cc279e5896e9796f8aba2fe721ce1ee2806bd181ddab8013f9878a2429d614117c7e5d6cbd44a82e0e129289787f64c48cfac2212
SSDEEP 24576:3NcwHdjbyQ4nLC18lb/EOjowL7FkdvoKFLgYHJWwl24C15rDY:3Nc/zEOVHFCQKKYpWwl1+NY
TLSH
T19E857B1622E901E4F5BBE1BE89779546FA71786913308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 952KB
SHA256 d28534dd0b5b8338f3a3253f9a62b8b0f1efca666bb1c19d004cc5985329b2fc
MD5 9e56f9b56d85051e5138c5bbb02f5a27
SHA1 bc87b1e3732e7f702b9e1ac79a00850121802fb9
SHA512 5f5e0e0075d23c71db00780567de686bf61bd4221fdd17f17ae412d298312a7e808a250087887627bcdf659dc7a7f1093e75bcd92680bd3246678c8415885e44
SSDEEP 24576:L6DIuKdIBAj1bsTEleyTJ6UAe+a20jckwqbJ:L6DIuKdVbsTK/JxZ20jckwq
TLSH
T16F25121D327A20B7C06BA17E85430142E1B2B9B4D71259DF1BE8C57D9E93FC8BA39E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 936KB
SHA256 5a835acab88946225b9316d41649f83dbda13d33a96a3a69c13f1867bce6519d
MD5 e66f960fcf6da3fe2a64cfe552e8a8b2
SHA1 cefcb5ead0908c7065ddc0b3c52a1f499d518318
SHA512 d4efae2e5650d11540693032e4ec55b452efeaa392c77f99a161da27b3e3d96995833e3f02190c282479f9e4f77c09712926db3fe26ebd60d8f55c4b88db1749
SSDEEP 24576:YtykKdIBAj1bsTEleyTJ6UAe+a20jckwqbJ:YtvKdVbsTK/JxZ20jckwq
TLSH
T1F015231562983977DD9B27B0891A01E25D38BC34AB1196EF65E1C73E7E34BC07E32B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 808KB
SHA256 28f7b2c97a88e5fa044246d6a6fc18cffb1f014d24db917316c018ecaf75571c
MD5 43da94c0bce70f00180c719544035395
SHA1 d296ed76bb51fd451bc454619d5637bc65b6049f
SHA512 a37b866178984153fa2fa42eb6f3efb93026d1c4e6c15a10c095c782594714f36b1d06a51927340adccdc8b0f9e86df6ac64135056c2e00e9f97f2e37f0a8432
SSDEEP 24576:yXKdIBAj1bsTEleyTJ6UAe+a20jckwqbJ:yXKdVbsTK/JxZ20jckwq
TLSH
T10A05232A64583A37CC473BF1440D06D724787EBC6B5258EFB5EA867DAD44BC02B32D4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 8dadb32e2b77e8a1974ed906f4ceef457340814ca1c67cae4e835686327c83c3
MD5 346ed82adb898782b919dedd6303c40d
SHA1 55d2275831541c43610e9f09ee4a2240a89c969a
SHA512 01465c1ac9a42995378ba5090b315b7f7edbdb41411c8e51c9a53458506d1e689b7d4f46c92d1ffb55d923e1d58d109230c87e350db14f56dffbbd776aa43aa8
SSDEEP 24576:vOgsLoTfaidZuKdIBAj1bsTEleyTJ6UAe+a20jckwqbJ:mg7TrZuKdVbsTK/JxZ20jckwq
TLSH
T15A65BE1DB7EA09DAE2B2D675D8221493D633B4315772C6CF2448C03A4DABED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 aa975294ab37119d1cc69196dedd79eb161d3334211ea91bc9e0d12c59632359
MD5 5d4b46f285d5d01c73b4783501a660bd
SHA1 42f01b95cdea71018bcca09e100031bb352058a5
SHA512 4005eaa8d8fa5ab1900ff428e2fe27b8a17c6754f5cb502c6de303216836ede979278c88dd1e522bc979946ac74d1e27cd8479387f8d0205e00dd787e3e0082a
SSDEEP 49152:Hgb4mBIBhGFFQKKYpWwl1+NYHCKdVbsTK/JxZ20jckwq:HtKKYpfgpYYsxZxjcr
TLSH
T102A5D01E22EC02F5E4FAE2B88DAA4417D6B278161731D2DF1151423D2F3BEE85E39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 335221c71801c9133410f65afb4916944e75902ae3afc8575186f03b14f737c3
MD5 0cd9c3424a6803001fd718b1c9fee651
SHA1 69717dfbae6beabdb7496a705b4905348a7776b4
SHA512 ca9398ac9888c8d2a308a0ebefe73f723480be66e8e0018faca19bab2fad42faf606f57ddec15300d65124ef5b8e7e1d87d797669f0b8e2cb678bc83938ea065
SSDEEP 24576:xTkNvNnaFeYhJNtmZBmsKdIBAj1bsTEleyTJ6UAe+a20jckwqbJ:xTMwBtOmsKdVbsTK/JxZ20jckwq
TLSH
T1DC75B02EB6F806E5D1FEC6B48D238512E6727861173293CB5390C13E1E679D89E36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1004KB
SHA256 1b49e9411db8d6c16e9458660931a609f60f52458552a494ea92c17131042a40
MD5 7e7aebf5f7fb2d4aa5defdd19edee726
SHA1 1ab09f37fad1c893f083136432ddbefc217e7ea1
SHA512 d3a22098a905abc1255c7684444c51dd34661fc04b50392c829fdafd2672b7a9d03a7689238c3345aff40ff29e6f0ad196d057738fcba8e23ec1a48056b0144f
SSDEEP 24576:xPUr+NQnKdIBAj1bsTEleyTJ6UAe+a20jckwqbJ:xJQnKdVbsTK/JxZ20jckwq
TLSH
T1F525022F21AC1CF6EA6BB27D85464749F671B8661312D2CF02E0813E5E53ED87D3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 2.3MB
SHA256 da63290e7df8001e94b35759dbb0fc154413d1171ad9941a33a9a2047d108286
MD5 be6a03f5eef4ed1d0bb41d7f799f2b67
SHA1 072e0e806f96eb7873775d34e19c3cf2b10d7e01
SHA512 cf6d7a4285fe3c2f0e5e36ddad072fb14d6ba015263706beb623d707a321569cf37e5163291f9aa57858ff8befd8841e0093250f1068d9fcf841ccc401037a31
SSDEEP 49152:aDVHeBIAAYQKKYpWwl1+NY2KdVbsTK/JxZ20jckwq:nKYpfgVYYsxZxjcr
TLSH
T11CB5023EE69C04F5D97BD2BC8A534507E2713CAD032155DB529581BA2F6BEE43E3AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 e903ac0f05dcf32cbf8feb630668f13c63f5c8733cab4b8ce42a40ce856c9471
MD5 72340af5af4d0ec72a7dc7894f6b7872
SHA1 31c6f50df3d82e496d31725d6963d5835db0289a
SHA512 7419f310ac071c1ba89283eef8971daeec169e09ebf21c969498c729b33088545c6477de096f1eb3b362fd64e7e27b30848183662c637cf776a77f4546e6989d
SSDEEP 24576:AJnJPbzB4S4KdIBAj1bsTEleyTJ6UAe+a20jckwqbJ:AJnJv6S4KdVbsTK/JxZ20jckwq
TLSH
T15135E13DD1A810EAD8B7D2B4811A179AFE71387D2B2269C759B4D5343F12FD06A39F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 800KB
SHA256 0b7c4adf2eff57298b5a34b038335bdc19c970a7b1b74b673787ebd46198c739
MD5 ef9fe1f248aac517268fcc8c5447d5ea
SHA1 c12404dac7fca8ace93e645873589b7a52df998d
SHA512 056859a1bd37055def18d7db8d6404b89f67f4f0fbfb565f57ec8e482a688725cdb5360c53daa487fe3fb29d273c0731a6857075e2c3b0fcfb6e36fbb705eb4e
SSDEEP 24576:4JKdIBAj1bsTEleyTJ6UAe+a20jckwqbJ:4JKdVbsTK/JxZ20jckwq
TLSH
T126052326A4582E37DC473BF1440D05E7246C7FACA75299EBB5AA463DBC44FD02B3384A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 944KB
SHA256 21c84999bcc172dd0812413790620786cbd1eff2bf93c364a6efa7e701ad1312
MD5 b6f6440e0d232a4e6b46da132f5128d3
SHA1 b6006ec01d43d936b8ff191ccb01cfb319bbce66
SHA512 372ba6a3d797da4255625d93c984e7ab5220134176194f24555bbb0693c550b8efaf1777810f3a29dfa86725cebc42a75112a6211dce6620d410b9b928f5b645
SSDEEP 24576:v6UqjpUKdIBAj1bsTEleyTJ6UAe+a20jckwqbJ:v6UNKdVbsTK/JxZ20jckwq
TLSH
T18C25231E65D838B7DC6B27B0881941A74078BD75276299EF72D8873E9E30FC05A3BE05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.2MB
SHA256 34ac57d529d970f067413c44c897c3792a5a4c56861ddf6e154c07a1b2628051
MD5 33c0237a21ba48223947d5ef308a6263
SHA1 51924186b63eb1173b80f4b608fd72a21e138b5e
SHA512 1439f6d5a56e50b7f13b8781bfc77c1318090513ee10bb345d2a4744e45db91b7d56bb184ef3001b2aec1eab316944537e86b5259c03712f53f66c83ff7053dc
SSDEEP 49152:YCLHGeeV5ijCmlDWDkAKdVbsTK/JxZ20jckwq:juYYsxZxjcr
TLSH
T143A57C05E7EB5184E8F3CAF5C92694169A327C549B34F7EF4A80CA6A1E32FD0D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\system32\wbem\WmiApSrv.exe
Size 968KB
SHA256 b6be53fd54277c3db9f15ec597973668c48afdd538402cd055ecaab318488473
MD5 dc8ee082a701109ea53884d6b3365155
SHA1 4a49e766afd2ccea72e70e31dcdc981e74b8b536
SHA512 71cac4482e1fbba7ea6794b8bfc7e5a3bd21f741ac8a8658c050bc296723894a476c2e39d8100fbd788882379f521ba2a7d77945d786070ec222f89422edd744
SSDEEP 24576:JrcmRxKdIBAj1bsTEleyTJ6UAe+a20jckwqbJ:dcmRxKdVbsTK/JxZ20jckwq
TLSH
T12225011FB2AE00B7D4A7927C88450296F6B37870631267DF42A1C77E5E57AE83E35B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\system32\wbengine.exe
Size 2.2MB
SHA256 52d92c45092f059cae5cb0d69636de092b9f1f27ec0829a5c871dd4d7f95a188
MD5 6e4dc4120688669166f6fe4f34a9fb2f
SHA1 b33c272eb6b2f2eb94d46c683016ef1dae176db2
SHA512 0235ae1caed6d4da89711d7ea9a23aeb07f2310d79a8fcd98a1c69b21bd6be621e5ed928c38a2c7cace82ae6dfe9bd41ae28e0bc059ab04cec7384435eb4f1fd
SSDEEP 49152:BDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3nKdVbsTK/JxZ20jckwq:y3Upow8sBKYYsxZxjcr
TLSH
T1EDB59D3DA2E810A9C8AAC379C54213A6EA71782D3F3015DB0174C578BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-44-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/240-45-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/240-38-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/240-37-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/240-320-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1868-83-0x0000000001620000-0x0000000001680000-memory.dmp

Download

memory/1868-61-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1868-62-0x0000000001620000-0x0000000001680000-memory.dmp

Download

memory/1868-85-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1868-68-0x0000000001620000-0x0000000001680000-memory.dmp

Download

memory/1996-107-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1996-96-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/1996-90-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/3108-21-0x0000000002D30000-0x0000000002D90000-memory.dmp

Download

memory/3108-13-0x0000000002D30000-0x0000000002D90000-memory.dmp

Download

memory/3108-0-0x0000000002600000-0x0000000002684000-memory.dmp

Download

memory/3108-8-0x0000000140000000-0x000000014197E000-memory.dmp

Download

memory/3108-106-0x0000000140000000-0x000000014197E000-memory.dmp

Download

memory/3108-6-0x0000000002600000-0x0000000002684000-memory.dmp

Download

memory/4144-351-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4144-170-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4144-176-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4144-163-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4208-343-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4208-57-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4208-51-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4208-50-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4400-128-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4400-129-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/4400-135-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/4400-350-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4808-349-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4808-116-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4808-115-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4808-109-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4808-347-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4968-147-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4968-154-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4968-159-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4968-148-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4968-161-0x0000000140000000-0x0000000140168000-memory.dmp

Download